Track relative project credentials for Agent verification

Invalidate stale Hermes verification when a relative native credential file changes. Checked with node --test desktop/test/workspace/local-workspace-agent-catalog.test.cjs.

desktop/src/workspace/agent-verification-identity.cjs

@@ -104,7 +104,7 @@ function projectVerificationIdentity(kind, workdir, agent = null, environmentIde
     deepseek: ['.env'],
     pi: [],
   }[kind]
-  if (!files && !environmentIdentity) return ''
+  if (!files && !environmentIdentity && !agent?.[NATIVE_PROJECT_CONFIG_PATHS]?.length) return ''
   if (kind === 'pi' && !environmentIdentity && !agent?.[NATIVE_PROJECT_CONFIG_PATHS]?.length) return ''
   if (typeof workdir !== 'string' || !path.isAbsolute(workdir)) return null
   const root = path.resolve(workdir)

desktop/test/workspace/local-workspace-agent-catalog.test.cjs

@@ -329,6 +329,7 @@ for (const [kind, relative, directory, filename] of [
   ['qwen', 'custom/system-defaults.json', false, 'custom/system-defaults.json'],
   ['pi', 'custom/credentials.json', false, 'custom/credentials.json'],
   ['claude', 'custom/token', false, 'custom/token'],
+  ['hermes', 'custom/credentials.json', false, 'custom/credentials.json'],
 ]) {
   test(`${kind} relative native configuration invalidates project verification`, t => {
     const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'meldwork-relative-config-'))